Summary
Warning viewing and revocation omit the user-management authorization checks applied when issuing warnings, allowing a moderator to act on users outside their management scope.
Affected Products
MyBB 1.8.40 (tested in the original report). The original report also identifies earlier 1.8.x releases; consult the vendor advisory for the authoritative range. Fixed in 1.8.41.
Affected Scope
- Product
- MyBB
- Component
- Warnings
- Affected function
- warnings.php — do_revoke / view / per-user warning list; inc/datahandlers/warnings.php
- Affected versions
- MyBB 1.8.40 (tested); consult vendor advisory for full range
- CWE
- CWE-863, CWE-862
Technical Summary
Warning viewing and revocation omit the user-management authorization checks applied when issuing warnings, allowing a moderator to act on users outside their management scope.
Prerequisites and Permissions
An authenticated moderator with canwarnusers and an existing warning concerning a user the moderator cannot manage.
Affected Locations
warnings.php — do_revoke / view / per-user warning list; inc/datahandlers/warnings.php
Reproducible Proof
In an isolated lab, create a warning on a disposable protected test account and confirm the limited moderator cannot manage that account. Compare warning creation checks with warning view/list access and revocation. Restore the disposable warning after testing.
Vulnerable Code
class="tok-comment">// Source report comparison: issuing warnings enforces this check.
if(!modcp_can_manage_user($user[&class="tok-comment">#39;uid'])) error(...);
class="tok-comment">// Corresponding check is absent from do_revoke / view / per-user list.Severity
medium
CVSS
5.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Technical Analysis
The warn flow calls modcp_can_manage_user(), but warning revocation, individual warning viewing and the per-user list do not apply the same management boundary. A moderator with canwarnusers can read warning reasons and revoke warnings involving otherwise unmanageable accounts, including administrators. The revocation flow also does not require that the requester issued the warning.
Original MyBB finding 26, submitted 9 August 2026. Vendor announced release 1.8.41 on 16 September and supplied the covered-finding/advisory mapping on 17 September 2026.
Impact
Confidentiality: warning notes and reasons can be disclosed. Integrity: warnings and their points can be revoked outside the moderator’s permitted scope, potentially lifting configured warning-level restrictions.
Remediation
Upgrade to MyBB 1.8.41 or a later supported release. Apply modcp_can_manage_user() and the intended issuer/revocation policy consistently to warning reads and updates.
Vendor advisory: https://github.com/advisories/GHSA-q93v-rjvr-8ggg
Timeline
- Published
- Advisory published
References
Credits
Reported by Aria Akhavan, Haikhavan.